@gajae-code/coding-agent 0.13.3 → 0.14.0

package/src/cli/auth-broker-cli.ts

@@ -17,6 +17,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { cleanReason } from "@gajae-code/ai/auth-broker/redact";
 import {
 	AuthBrokerClient,
 	type AuthCredential,
@@ -28,13 +29,19 @@ import {
 	listProvidersWithEnvKey,
 	type OAuthCredential,
 	type OAuthProvider,
+	resolveOAuthStorageProvider,
 	SqliteAuthCredentialStore,
 	startAuthBroker,
 } from "@gajae-code/ai/core";
-import { $which, APP_NAME, getAgentDbPath, getConfigRootDir, isEnoent, logger, VERSION } from "@gajae-code/utils";
+import { $which, APP_NAME, getAgentDbPath, getConfigRootDir, logger, VERSION } from "@gajae-code/utils";
 import { $ } from "bun";
 import chalk from "chalk";
-import { resolveAuthBrokerConfig } from "../session/auth-broker-config";
+import {
+	createSecureTokenFileExclusive,
+	readSecureTokenFile,
+	writeSecureTokenFile,
+} from "../session/secure-token-file";
+import { resolveStartupAuthConfig } from "../session/startup-auth-config";
 
 export type AuthBrokerAction = "serve" | "token" | "login" | "logout" | "status" | "import" | "migrate";
 
@@ -62,6 +69,39 @@ export interface AuthBrokerCommandArgs {
 
 const ACTIONS: readonly AuthBrokerAction[] = ["serve", "token", "login", "logout", "import", "migrate", "status"];
 
+type AuthBrokerCliErrorCode =
+	| "broker_unavailable"
+	| "credential_import_failed"
+	| "credential_migration_failed"
+	| "auth_broker_command_failed";
+
+function stableErrorForAction(action: AuthBrokerAction): { code: AuthBrokerCliErrorCode; message: string } {
+	switch (action) {
+		case "status":
+			return { code: "broker_unavailable", message: "Auth broker is unavailable." };
+		case "import":
+			return { code: "credential_import_failed", message: "Credential import failed." };
+		case "migrate":
+			return { code: "credential_migration_failed", message: "Credential migration failed." };
+		default:
+			return { code: "auth_broker_command_failed", message: "Auth broker command failed." };
+	}
+}
+
+function safeDiagnostic(value: unknown, fallback: string): string {
+	return cleanReason(value) ?? fallback;
+}
+
+function writeCommandFailure(action: AuthBrokerAction, flags: AuthBrokerCommandArgs["flags"], error: unknown): void {
+	const stable = stableErrorForAction(action);
+	if (flags.json) {
+		process.stdout.write(`${JSON.stringify({ ok: false, error: stable })}\n`);
+	} else {
+		process.stderr.write(`${chalk.red("FAILED")} ${safeDiagnostic(error, stable.message)}\n`);
+	}
+	process.exitCode = 1;
+}
+
 /** Callback ports baked from the per-provider OAuth flow modules. */
 const CALLBACK_PORTS: Record<string, number> = {
 	anthropic: 54545,
@@ -78,25 +118,15 @@ function getTokenFilePath(): string {
 }
 
 async function readToken(): Promise<string | null> {
-	try {
-		const raw = await Bun.file(getTokenFilePath()).text();
-		const trimmed = raw.trim();
-		return trimmed.length > 0 ? trimmed : null;
-	} catch (err) {
-		if (isEnoent(err)) return null;
-		throw err;
-	}
+	return readSecureTokenFile(getTokenFilePath());
 }
 
 async function writeToken(token: string): Promise<void> {
-	const file = getTokenFilePath();
-	await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-	await Bun.write(file, token);
-	try {
-		await fs.chmod(file, 0o600);
-	} catch {
-		// Best-effort (e.g. Windows).
-	}
+	await writeSecureTokenFile(getTokenFilePath(), token);
+}
+
+async function createTokenExclusive(token: string): Promise<boolean> {
+	return createSecureTokenFileExclusive(getTokenFilePath(), token);
 }
 
 function generateToken(): string {
@@ -107,8 +137,19 @@ async function ensureToken(): Promise<string> {
 	const existing = await readToken();
 	if (existing) return existing;
 	const token = generateToken();
-	await writeToken(token);
-	return token;
+	if (await createTokenExclusive(token)) return token;
+	// Another concurrent invocation won the create race. Its file may exist
+	// briefly before the winner writes the token, so retry reads without ever
+	// overwriting the winner's file.
+	for (let attempt = 0; attempt < 5; attempt++) {
+		const fromRace = await readToken();
+		if (fromRace) return fromRace;
+		if (attempt < 4) await Bun.sleep(10);
+	}
+	// If the file disappeared, make one final exclusive-create attempt. Never
+	// fall back to an unconditional write after observing EEXIST.
+	if (await createTokenExclusive(token)) return token;
+	throw new Error("Unable to initialize auth-broker token: another process owns an empty token file.");
 }
 
 async function runServe(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
@@ -133,7 +174,7 @@ async function runServe(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 	logger.info("auth-broker bearer token loaded", { path: getTokenFilePath(), mode: "0600" });
 
 	const credentialDisabledUnsub = storage.onCredentialDisabled((event: CredentialDisabledEvent) => {
-		logger.warn("auth-broker credential disabled", { ...event });
+		logger.warn("auth-broker credential disabled", { provider: event.provider });
 	});
 
 	const shutdown = async (signal: NodeJS.Signals): Promise<void> => {
@@ -241,10 +282,11 @@ async function runLogout(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 	if (!providerArg) {
 		throw new Error("Usage: gjc auth-broker logout <provider>");
 	}
+	const provider = resolveOAuthStorageProvider(providerArg);
 	const store = await SqliteAuthCredentialStore.open(getAgentDbPath());
 	try {
-		store.deleteAuthCredentialsForProvider(providerArg, "logged out by user");
-		process.stdout.write(`Logged out of ${providerArg}\n`);
+		store.deleteAuthCredentialsForProvider(provider, "logged out by user");
+		process.stdout.write(`Logged out of ${provider}\n`);
 	} finally {
 		store.close();
 	}
@@ -338,7 +380,7 @@ async function loadImportPlan(
 		try {
 			json = (await Bun.file(file).json()) as CliProxyCredentialJson;
 		} catch (err) {
-			skipped.push({ file, reason: `unreadable JSON: ${String(err)}` });
+			skipped.push({ file, reason: `unreadable JSON: ${safeDiagnostic(err, "unreadable JSON")}` });
 			continue;
 		}
 		if (json.disabled === true && !includeDisabled) {
@@ -415,14 +457,19 @@ async function runImport(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 					disabled: e.disabled,
 					file: e.sourceFile,
 				})),
-				skipped,
+				skipped: skipped.map(skip => ({
+					...skip,
+					reason: safeDiagnostic(skip.reason, "Credential import skipped."),
+				})),
 			})}\n`,
 		);
 	}
 
 	if (!flags.json) {
 		for (const skip of skipped) {
-			process.stdout.write(`${chalk.yellow("skip")} ${skip.file}: ${skip.reason}\n`);
+			process.stdout.write(
+				`${chalk.yellow("skip")} ${skip.file}: ${safeDiagnostic(skip.reason, "Credential import skipped.")}\n`,
+			);
 		}
 	}
 
@@ -439,7 +486,7 @@ async function runImport(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 		return;
 	}
 
-	const brokerConfig = await resolveAuthBrokerConfig();
+	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	if (brokerConfig) {
 		const client = new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });
 		for (const entry of entries) {
@@ -449,11 +496,14 @@ async function runImport(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 					process.stdout.write(`${chalk.green("uploaded")} ${describeImportEntry(entry)} → ${brokerConfig.url}\n`);
 				}
 			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
 				if (flags.json) {
-					process.stdout.write(`${JSON.stringify({ error: message, file: entry.sourceFile })}\n`);
+					process.stdout.write(
+						`${JSON.stringify({ ok: false, error: { code: "credential_import_failed", message: "Credential import failed." }, file: entry.sourceFile })}\n`,
+					);
 				} else {
-					process.stdout.write(`${chalk.red("failed")} ${describeImportEntry(entry)}: ${message}\n`);
+					process.stdout.write(
+						`${chalk.red("failed")} ${describeImportEntry(entry)}: ${safeDiagnostic(error, "Credential import failed.")}\n`,
+					);
 				}
 				process.exitCode = 1;
 			}
@@ -531,7 +581,7 @@ function brokerAlreadyHas(existing: Map<string, Set<string>>, provider: string,
 }
 
 async function runMigrate(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
-	const brokerConfig = await resolveAuthBrokerConfig();
+	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	if (!brokerConfig) {
 		throw new Error(
 			"GJC_AUTH_BROKER_URL must be set (or `auth.broker.url` in config.yml). `migrate` uploads local credentials to a configured broker.",
@@ -640,13 +690,16 @@ async function runMigrate(flags: AuthBrokerCommandArgs["flags"]): Promise<void>
 			`${JSON.stringify({
 				dryRun: flags.dryRun === true,
 				plan: plan.map(p => ({ source: p.source, provider: p.provider, identity: p.identity })),
-				skipped,
+				skipped: skipped.map(skip => ({
+					...skip,
+					reason: safeDiagnostic(skip.reason, "Credential migration skipped."),
+				})),
 			})}\n`,
 		);
 	} else {
 		for (const skip of skipped) {
 			process.stdout.write(
-				`${chalk.yellow("skip")} [${skip.source}] ${skip.provider} ${skip.identity}: ${skip.reason}\n`,
+				`${chalk.yellow("skip")} [${skip.source}] ${skip.provider} ${skip.identity}: ${safeDiagnostic(skip.reason, "Credential migration skipped.")}\n`,
 			);
 		}
 	}
@@ -673,11 +726,14 @@ async function runMigrate(flags: AuthBrokerCommandArgs["flags"]): Promise<void>
 				process.stdout.write(`${chalk.green("uploaded")} [${entry.source}] ${entry.provider} ${entry.identity}\n`);
 			}
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
 			if (flags.json) {
-				process.stdout.write(`${JSON.stringify({ error: message, provider: entry.provider })}\n`);
+				process.stdout.write(
+					`${JSON.stringify({ ok: false, error: { code: "credential_migration_failed", message: "Credential migration failed." }, provider: entry.provider })}\n`,
+				);
 			} else {
-				process.stdout.write(`${chalk.red("failed")} [${entry.source}] ${entry.provider}: ${message}\n`);
+				process.stdout.write(
+					`${chalk.red("failed")} [${entry.source}] ${entry.provider}: ${safeDiagnostic(error, "Credential migration failed.")}\n`,
+				);
 			}
 			process.exitCode = 1;
 		}
@@ -685,10 +741,13 @@ async function runMigrate(flags: AuthBrokerCommandArgs["flags"]): Promise<void>
 }
 
 async function runStatus(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
-	const cfg = await resolveAuthBrokerConfig();
+	const cfg = (await resolveStartupAuthConfig()).broker;
 	if (!cfg) {
 		const message = "No auth-broker configured (set GJC_AUTH_BROKER_URL to enable).";
-		if (flags.json) process.stdout.write(`${JSON.stringify({ ok: false, reason: "not_configured" })}\n`);
+		if (flags.json)
+			process.stdout.write(
+				`${JSON.stringify({ ok: false, error: { code: "broker_not_configured", message: "Auth broker is not configured." } })}\n`,
+			);
 		else process.stdout.write(`${chalk.yellow(message)}\n`);
 		return;
 	}
@@ -701,44 +760,55 @@ async function runStatus(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 			process.stdout.write(`${chalk.green("OK")} ${cfg.url} (version=${health.version ?? "unknown"})\n`);
 		}
 	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
 		if (flags.json) {
-			process.stdout.write(`${JSON.stringify({ ok: false, url: cfg.url, error: message })}\n`);
+			process.stdout.write(
+				`${JSON.stringify({ ok: false, url: cfg.url, error: { code: "broker_unavailable", message: "Auth broker is unavailable." } })}\n`,
+			);
 		} else {
-			process.stdout.write(`${chalk.red("FAILED")} ${cfg.url}: ${message}\n`);
+			process.stdout.write(
+				`${chalk.red("FAILED")} ${cfg.url}: ${safeDiagnostic(error, "Auth broker is unavailable.")}\n`,
+			);
 		}
 		process.exitCode = 1;
 	}
 }
 
 export async function runAuthBrokerCommand(cmd: AuthBrokerCommandArgs): Promise<void> {
-	switch (cmd.action) {
-		case "serve":
-			await runServe(cmd.flags);
-			return;
-		case "token":
-			await runToken(cmd.flags);
-			return;
-		case "login":
-			await runLogin(cmd.flags);
-			return;
-		case "logout":
-			await runLogout(cmd.flags);
-			return;
-		case "import":
-			await runImport(cmd.flags);
-			return;
-		case "migrate":
-			await runMigrate(cmd.flags);
-			return;
-		case "status":
-			await runStatus(cmd.flags);
+	try {
+		switch (cmd.action) {
+			case "serve":
+				await runServe(cmd.flags);
+				return;
+			case "token":
+				await runToken(cmd.flags);
+				return;
+			case "login":
+				await runLogin(cmd.flags);
+				return;
+			case "logout":
+				await runLogout(cmd.flags);
+				return;
+			case "import":
+				await runImport(cmd.flags);
+				return;
+			case "migrate":
+				await runMigrate(cmd.flags);
+				return;
+			case "status":
+				await runStatus(cmd.flags);
+				return;
+			default: {
+				// Exhaustive check.
+				const _exhaustive: never = cmd.action;
+				throw new Error(`Unknown auth-broker action: ${String(_exhaustive)}`);
+			}
+		}
+	} catch (error) {
+		if (cmd.action === "status" || cmd.action === "import" || cmd.action === "migrate") {
+			writeCommandFailure(cmd.action, cmd.flags, error);
 			return;
-		default: {
-			// Exhaustive check.
-			const _exhaustive: never = cmd.action;
-			throw new Error(`Unknown auth-broker action: ${String(_exhaustive)}`);
 		}
+		throw error;
 	}
 }
 

package/src/cli/auth-gateway-cli.ts

@@ -13,8 +13,8 @@
  *   - `status` — prints the locally-stored gateway token and bind hint.
  */
 import * as crypto from "node:crypto";
-import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { cleanReason } from "@gajae-code/ai/auth-broker/redact";
 import { startAuthGateway } from "@gajae-code/ai/auth-gateway/server";
 import {
 	type Api,
@@ -28,9 +28,14 @@ import {
 	RemoteAuthCredentialStore,
 	type SnapshotResponse,
 } from "@gajae-code/ai/core";
-import { getConfigRootDir, isEnoent, VERSION } from "@gajae-code/utils";
+import { getConfigRootDir, VERSION } from "@gajae-code/utils";
 import chalk from "chalk";
-import { type AuthBrokerClientConfig, resolveAuthBrokerConfig } from "../session/auth-broker-config";
+import {
+	createSecureTokenFileExclusive,
+	readSecureTokenFile,
+	writeSecureTokenFile,
+} from "../session/secure-token-file";
+import { type AuthBrokerClientConfig, resolveStartupAuthConfig } from "../session/startup-auth-config";
 
 export type AuthGatewayAction = "serve" | "token" | "status" | "check";
 
@@ -51,53 +56,51 @@ export interface AuthGatewayCommandArgs {
 
 const ACTIONS: readonly AuthGatewayAction[] = ["serve", "token", "status", "check"];
 
+type AuthGatewayCliErrorCode =
+	| "broker_not_configured"
+	| "broker_unavailable"
+	| "credential_check_failed"
+	| "auth_gateway_command_failed";
+
+function stableErrorForAction(action: AuthGatewayAction): { code: AuthGatewayCliErrorCode; message: string } {
+	switch (action) {
+		case "status":
+			return { code: "broker_unavailable", message: "Auth broker is unavailable." };
+		case "check":
+			return { code: "credential_check_failed", message: "Credential check failed." };
+		default:
+			return { code: "auth_gateway_command_failed", message: "Auth gateway command failed." };
+	}
+}
+
+function safeDiagnostic(value: unknown, fallback: string): string {
+	return cleanReason(value) ?? fallback;
+}
+
+function writeCommandFailure(action: AuthGatewayAction, flags: AuthGatewayCommandArgs["flags"], error: unknown): void {
+	const stable = stableErrorForAction(action);
+	if (flags.json) {
+		process.stdout.write(`${JSON.stringify({ ok: false, error: stable })}\n`);
+	} else {
+		process.stderr.write(`${chalk.red("FAILED")} ${safeDiagnostic(error, stable.message)}\n`);
+	}
+	process.exitCode = 1;
+}
+
 function getTokenFilePath(): string {
 	return path.join(getConfigRootDir(), "auth-gateway.token");
 }
 
 async function readToken(): Promise<string | null> {
-	try {
-		const raw = await Bun.file(getTokenFilePath()).text();
-		const trimmed = raw.trim();
-		return trimmed.length > 0 ? trimmed : null;
-	} catch (err) {
-		if (isEnoent(err)) return null;
-		throw err;
-	}
+	return readSecureTokenFile(getTokenFilePath());
 }
 
 async function writeToken(token: string): Promise<void> {
-	const file = getTokenFilePath();
-	await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-	await fs.writeFile(file, token, { mode: 0o600 });
-	try {
-		await fs.chmod(file, 0o600);
-	} catch {
-		// Best-effort (e.g. Windows).
-	}
+	await writeSecureTokenFile(getTokenFilePath(), token);
 }
 
-/**
- * Atomically create the token file, refusing to clobber an existing one.
- * Returns `true` on success, `false` when the file already existed (so the
- * caller re-reads it instead of racing another concurrent `ensureToken`).
- */
 async function createTokenExclusive(token: string): Promise<boolean> {
-	const file = getTokenFilePath();
-	await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-	try {
-		// `wx` = O_CREAT | O_EXCL — fails with EEXIST if the file is already there.
-		await fs.writeFile(file, token, { flag: "wx", mode: 0o600 });
-	} catch (err) {
-		if ((err as NodeJS.ErrnoException).code === "EEXIST") return false;
-		throw err;
-	}
-	try {
-		await fs.chmod(file, 0o600);
-	} catch {
-		// Best-effort (e.g. Windows).
-	}
-	return true;
+	return createSecureTokenFileExclusive(getTokenFilePath(), token);
 }
 
 function generateToken(): string {
@@ -109,13 +112,18 @@ async function ensureToken(): Promise<string> {
 	if (existing) return existing;
 	const token = generateToken();
 	if (await createTokenExclusive(token)) return token;
-	// Another concurrent invocation won the create race; read what they wrote.
-	const fromRace = await readToken();
-	if (fromRace) return fromRace;
-	// File existed-then-disappeared between EEXIST and read; last resort, write
-	// our generated token unconditionally so callers don't see an empty string.
-	await writeToken(token);
-	return token;
+	// Another concurrent invocation won the create race. Its file may exist
+	// briefly before the winner writes the token, so retry reads without ever
+	// overwriting the winner's file.
+	for (let attempt = 0; attempt < 5; attempt++) {
+		const fromRace = await readToken();
+		if (fromRace) return fromRace;
+		if (attempt < 4) await Bun.sleep(10);
+	}
+	// If the file disappeared, make one final exclusive-create attempt. Never
+	// fall back to an unconditional write after observing EEXIST.
+	if (await createTokenExclusive(token)) return token;
+	throw new Error("Unable to initialize auth-gateway token: another process owns an empty token file.");
 }
 
 function createBrokerClient(brokerConfig: AuthBrokerClientConfig): AuthBrokerClient {
@@ -129,7 +137,7 @@ async function fetchBrokerSnapshot(client: AuthBrokerClient): Promise<SnapshotRe
 }
 
 async function runServe(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
-	const brokerConfig = await resolveAuthBrokerConfig();
+	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	if (!brokerConfig) {
 		throw new Error(
 			"`gjc auth-gateway serve` requires GJC_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). The gateway is itself a broker client.",
@@ -243,12 +251,13 @@ async function runToken(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 
 async function runStatus(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 	const token = await readToken();
-	const brokerConfig = await resolveAuthBrokerConfig();
+	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	const tokenFile = getTokenFilePath();
 	if (!brokerConfig) {
 		const status = {
 			ready: false,
-			reason: "not_configured",
+			reason: "broker_not_configured",
+			error: { code: "broker_not_configured", message: "Auth broker is not configured." },
 			tokenFile,
 			tokenPresent: token !== null,
 			broker: null,
@@ -298,7 +307,6 @@ async function runStatus(flags: AuthGatewayCommandArgs["flags"]): Promise<void>
 		}
 		if (!tokenPresent) process.exitCode = 1;
 	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
 		const status = {
 			ready: false,
 			reason: "broker_unavailable",
@@ -307,12 +315,14 @@ async function runStatus(flags: AuthGatewayCommandArgs["flags"]): Promise<void>
 			broker: brokerConfig.url,
 			brokerConfigured: true,
 			brokerAuthenticated: false,
-			error: message,
+			error: { code: "broker_unavailable", message: "Auth broker is unavailable." },
 		};
 		if (flags.json) {
 			process.stdout.write(`${JSON.stringify(status)}\n`);
 		} else {
-			process.stdout.write(`${chalk.red("FAILED")} upstream broker: ${brokerConfig.url}: ${message}\n`);
+			process.stdout.write(
+				`${chalk.red("FAILED")} upstream broker: ${brokerConfig.url}: ${safeDiagnostic(error, "Auth broker is unavailable.")}\n`,
+			);
 			process.stdout.write(
 				`token: ${status.tokenPresent ? chalk.green("present") : chalk.red("missing")} at ${status.tokenFile}\n`,
 			);
@@ -322,23 +332,31 @@ async function runStatus(flags: AuthGatewayCommandArgs["flags"]): Promise<void>
 }
 
 export async function runAuthGatewayCommand(cmd: AuthGatewayCommandArgs): Promise<void> {
-	switch (cmd.action) {
-		case "serve":
-			await runServe(cmd.flags);
-			return;
-		case "token":
-			await runToken(cmd.flags);
-			return;
-		case "status":
-			await runStatus(cmd.flags);
-			return;
-		case "check":
-			await runCheck(cmd.flags);
+	try {
+		switch (cmd.action) {
+			case "serve":
+				await runServe(cmd.flags);
+				return;
+			case "token":
+				await runToken(cmd.flags);
+				return;
+			case "status":
+				await runStatus(cmd.flags);
+				return;
+			case "check":
+				await runCheck(cmd.flags);
+				return;
+			default: {
+				const _exhaustive: never = cmd.action;
+				throw new Error(`Unknown auth-gateway action: ${String(_exhaustive)}`);
+			}
+		}
+	} catch (error) {
+		if (cmd.action === "status" || cmd.action === "check") {
+			writeCommandFailure(cmd.action, cmd.flags, error);
 			return;
-		default: {
-			const _exhaustive: never = cmd.action;
-			throw new Error(`Unknown auth-gateway action: ${String(_exhaustive)}`);
 		}
+		throw error;
 	}
 }
 
@@ -350,7 +368,7 @@ export async function runAuthGatewayCommand(cmd: AuthGatewayCommandArgs): Promis
  * dedicated diagnostic is the only way to see which credentials failed.
  */
 async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
-	const brokerConfig = await resolveAuthBrokerConfig();
+	const brokerConfig = (await resolveStartupAuthConfig()).broker;
 	if (!brokerConfig) {
 		throw new Error(
 			"`gjc auth-gateway check` requires GJC_AUTH_BROKER_URL (or `auth.broker.url`/`auth.broker.token` in config.yml). It probes the same credentials the gateway would serve.",
@@ -366,7 +384,11 @@ async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 		const results = await storage.checkCredentials();
 
 		if (flags.json) {
-			process.stdout.write(`${JSON.stringify({ broker: brokerConfig.url, credentials: results }, null, 2)}\n`);
+			const credentials = results.map(row => ({
+				...row,
+				...(row.reason ? { reason: safeDiagnostic(row.reason, "Credential check failed.") } : {}),
+			}));
+			process.stdout.write(`${JSON.stringify({ broker: brokerConfig.url, credentials }, null, 2)}\n`);
 		} else {
 			const grouped = new Map<string, typeof results>();
 			for (const row of results) {
@@ -389,7 +411,9 @@ async function runCheck(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {
 					const identity =
 						row.email ?? row.accountId ?? (row.type === "api_key" ? "(api key)" : "(no identity on credential)");
 					const remote = row.remoteRefresh ? chalk.dim(" [remote-refresh]") : "";
-					const reason = row.reason ? chalk.dim(` — ${row.reason}`) : "";
+					const reason = row.reason
+						? chalk.dim(` — ${safeDiagnostic(row.reason, "Credential check failed.")}`)
+						: "";
 					process.stdout.write(
 						`  ${status} id=${row.id.toString().padStart(3)} ${row.type.padEnd(7)} ${identity}${remote}${reason}\n`,
 					);

package/src/cli/config-cli.ts

@@ -10,6 +10,9 @@ import type * as path from "node:path";
 import { APP_NAME, getAgentDir } from "@gajae-code/utils";
 import { YAML } from "bun";
 import chalk from "chalk";
+import { resolveModelProfileName } from "../config/model-profile-contract";
+import { mergeModelProfiles } from "../config/model-profiles";
+import { ModelsConfigFile } from "../config/model-registry";
 import {
 	getDefault,
 	getEnumValues,
@@ -21,6 +24,7 @@ import {
 	type SettingValue,
 	settings,
 } from "../config/settings";
+import { resolveEagerTaskDelegation } from "../config/task-delegation";
 import { theme } from "../modes/theme/theme";
 import { initXdg } from "./commands/init-xdg";
 
@@ -449,17 +453,38 @@ function handlePath(): void {
 	console.log(getAgentDir());
 }
 
+/**
+ * Configuration conflicts that no schema check can see: an explicit
+ * `task.eager false` keeps a vendor-separated profile's workers unused, so the
+ * main provider's quota pays for work the layout meant to offload.
+ */
+export function collectConfigAdvisories(): string[] {
+	const profileName = settings.get("modelProfile.default");
+	const profiles = mergeModelProfiles(ModelsConfigFile.load()?.profiles);
+	const resolvedProfileName = profileName ? resolveModelProfileName(profileName, profiles) : undefined;
+	const delegation = resolveEagerTaskDelegation({
+		settings,
+		profile: resolvedProfileName ? profiles.get(resolvedProfileName) : undefined,
+	});
+	if (!delegation.suppressedByExplicitSetting) return [];
+	return [
+		`task.eager is false while ${delegation.vendorSeparatedRoles.join(" and ")} run on a different provider than the default role; those workers will not be used. Run \`${APP_NAME} config set task.eager true\` or reset task.eager to delegate by default.`,
+	];
+}
+
 function handleDoctor(flags: { json?: boolean }): void {
 	const report = settings.getSchemaReport();
+	const advisories = collectConfigAdvisories();
 	if (flags.json) {
-		console.log(JSON.stringify(report, null, 2));
+		console.log(JSON.stringify({ ...report, advisories }, null, 2));
 		return;
 	}
-	if (report.issues.length === 0) {
+	if (report.issues.length === 0 && advisories.length === 0) {
 		console.log(chalk.green("Settings schema is healthy."));
 		return;
 	}
 	for (const issue of report.issues) console.log(`${issue.kind}\t${issue.path}\t${issue.detail}`);
+	for (const advisory of advisories) console.log(chalk.yellow(`advisory\ttask.eager\t${advisory}`));
 }
 
 type ConfigDoctorReport = {